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1571 Abstract- The system and method provide for an attribute certificate for a user based on a hash tree of attribute data. Typically. 
a uleto a cnen! system makes a request to an attribute authority system to provide a set of attribute data (42 a-h) used to prov.de 
he u er wi* Lcess o one or more resources, such as a computer system or database. The attribute authonty generates a hash ue 
40^ Ta hashed root (50) from the full.set of attribute data for a user. The attribute authority generates an attnbute certificate that 
Suto a o5 SfsiSre cateulattd from the root (50). and, optionally, the value of the root (50) itself. The attnbute authonty also 
^ for the set of attribute data requested by the user. Typically, the attribute authonty responds to a user s 

requfst by uansltine the attribute certificate (42 a-h). the verification data, and the requested set of attnbute da* to the chent, 
Xh in turn sends the transmitted information to one or more resources to allow access by the user to the resources. 
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System and Method for Generating and Managing 
Attribute Certificates 



Field of the Invention 

The invention relates generally to the field of computer, security and authentication and, 
more particularly, to a system and method for generating and managing attribute certificates. 

• Background of the Invention 
5 . ' : Certificates are used in the field of computer security. For example, certificates are used 
in the process of authenticating a user and allowing the user to access a computer or to access 
specific resources located on the computer or over a network. 

An attribute certificate is a form of digital credential that binds identification information 
about a user and user attributes. The identification information may be a name, a public key, a 
10 reference to another certificate, other information, or a combination of the foregoing. A public 
-key may be used as part of a public/private key- cryptography system, such as a system based on 
RSA public/private key cryptography. 

Attributes are additional information about a user and often 'specify, authorization- data, 
such. as the authorization to use a particular computer system of other resource. 'A common form 
15 of authorization data is an encrypted password, where thepasswdrd grants access^o the resource, 
and is encrypted in a way thafdrily the resource can Obtain it! An attribute' certificate is^typically 
•• issued by a- computer "system or serv'er -refetred to as -an attribute authority, and the attribute 
"certificate typically includes a digital signature of the attribute authority on the contents of the 
^certificate. v *■ , v ■■. .r 

20 Typically, a small number of attribute certificates, perhaps only one; is -associated with a 

user, and such an attribute certificate is often valid for a relatively- short period of time, such as 
24 hours.- The user typically requests ah attribute certificate from an attribute authority after 
authenticating or otherwise interacting with the attribute authority via a network, such as an 

■ intranet or the Internet. This request typically happens when -a user first needs- access to a 

<15 resource, for example, when a worker first begins "her work' day. * In thereque'st, the user specifies 

■ that' the attribute certificate'include authorization data fora selected set of resources.- This 
selected set of resources may be smaller than the full set of resources that the user is allowed 
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access to. If the user later wishes to access a resource not in the selected set of resources, then 
the user must request another attribute certificate. 

The user may not wish to request a full set of authorization information because the 
resulting attribute certificate may be very large. In addition, the user may not wish to disclose the 
5 full set of the user's allowed resources to other users or resources, for example, in the interest of 
privacy, security, or anonymity. 

"An attribute authority may pregenefate attribute-certificates, when possible, to reduce the 
computational load at peak times, sucK as when many users kre fogging in at the beginning of the 
work day. However, it is difficult for the attribute authority to pregenerate attribute certificates if 
10 the attribute authority does not know the user's desired selection until the user requests it. For 
example, an attribute authority may pregenerate an attribute certificate for abuser, based on what 
the user typically selects as a. set of resources. However, if the user, requests an attribute 
certificate for a different set of resources, the attribute authority must newly generate the attribute 
certificate. Alternatively, the attribute authority could pregenerate many different attribute 
15: certificates for a user based on many different sets of resources that could potentially be selected 
by the user; This approach may unnecessarily consume computational resources and data storage 
space for a large number of pregenerated attribute certificates. • 
? - - Summary =of the Invention ■ . ..... 

r . . t . r . . OnejDtiject of the invention is.to-proyide a system and method for generating- attribute 
>2Q, certificates -that allows -for, the efficient pregeneration- of attribute certificates,- : wherein only one 
. r . '.attribttf^ generated-per-user, even thpugh-the userjnay request access-to 

■ different 'subsets of resources: at-d if fere nt times,. Another obje.ct-.of the -invention is:-to distribute 
..only the attributes required to-acpess- a selected resource)] without, distributing unnecessarily other 
attribute data for the user. A further object is to limit the size of the attribute certificate-as well 
25 , as any.yerification/datar^needed to. verify the attribute data.for L a selected resource; 
: :. .-. , :-. In qae -aspect, the inyen-tion^elates to,a method for providing attribute-information to a 
/user, the attribute information; providing the user with access to.A resource.^ The methoji includes 
c r generating a hash tree, having a -root from attribute data associated, with a user; selecting^ set of 
the attribute:data; detegnm data capable of verifying the set of attribute, data in the 

r 30 . \hash tree; calculating aidigital^signature^using the; root as.inputy generating an attribute certificate 
.including, the digital signature^ and transferring the attribute certificate,' the verification data s and 
\ ■ ..the^set of^the attribute data.jtp the .user..- . •- ; . . .- :m . \ *; --- * ... 
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In one embodiment, the method includes generating an attribute certificate including the 
root and the digital signature. In another embodiment, the method includes allocating the 
attribute data to the leaves of the hash tree and determining verification data for one or more 
leaves of the hash tree. In a further embodiment, the attribute certificate is generated 
independently of a request by the user. In another embodiment, the attribute certificate includes 
the root of the hash tree, the verification data, and the digital signature. In another embodiment, 
the method includes encrypting the set of the attribute data, or a subset of the attribute data, 
before transferring the attribute certificate, the verification data, and the set of attribute data to 
the user. 

In another aspect, the invention relates to an attribute authority for providing attribute 
information to a user, the attribute information providing the user with access to a resource. The 
attribute authority includes attribute data for a user, a hash tree generated based on the attribute 
data, an attribute certificate including a digital signature, calculated using a root of the hash tree 
as input, and verification data capable of verifying a set of the attribute data in the hash tree. The 
attribute authority transfers the attribute certificate, the verification data, and the set of the 
attribute data to the user. 

In one embodiment, the attribute certificate includes the root and the digital signature. In 
another embodiment, the hash tree includes leaves of attribute data, and the verification data 
includes verification data for one or more leaves of the hash tree. In a further embodiment, the 
attribute authority generates the attribute certificate independently of a request by the user. In 
another embodiment; the attribute certificate includes'the fodt oif the hash' tree, the verification 
data, and the digital signature/ In 1 another 'embodiment, the attribute information includes the 
attribute certificate, the* verification ddta, and an Encrypted set of the attribute data. - ; 

In another aspect, the invention relates to a method for verifying attribute information 
received from a user. In one embodiment, the method includes receiving an attribute certificate 
including a digital signature calculated using as input an initial root of a hash tree that is 
generated from attribute data associated with a user; receiving a set of the attribute data; 
receiving verification data associated with the set of the attribute data; verifying the set of the 
attribute data using the attributed certificate and the verification data; and allowing access to a 
resource after verifying the set of the attribute data. 

. In another aspect, the invention relates to a system for verifying attribute information 
received from a user, including an input interface for receiving an attribute certificate, a set of 
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attribute data associated with a user, verification data used to verify the set of attribute data, and a 
verifier in electrical communication with the input interface. In one embodiment, the attribute 
certificate includes a digital signature calculated using as input an initial root of a hash tree that is 
generated based on attribute data. The input interface receives the attribute certificate, the set of 
5 the attribute data, and the verification data from the user, and the verifier allows access to a 
resource based on the verification of the set of the attribute data using the attribute certificate, 
and the verification data. 

In another aspect, the invention relates to a method for using attribute information to 
obtain access to a resource. In one embodiment, the method includes receiving an attribute 
10 certificate including a digital signature calculated using as input a root of a hash tree generated 
based on attribute data for a user; receiving the attribute data; receiving verification data capable 
of verifying the attribute data; transferring to a resource the attribute certificate, the attribute data, 
and the verification data; verifying the attribute data using the attribute certificate andthe: 
verification data; and obtaining access to the resource in response to verifying the attribute data. 

15 In one embodiment, the method includes receiving a set of attribute data and set of 

verification data capable of verifying the set of attribute data. In a further embodiment, the 
method includes transferring to the resource a subset, of the attribute data and subset verification 
data capable of verifying the subset of the attribute data, and verifying the subset of the attribute 
data with the subset verification data. . . , 

2Q # An another, aspect,, the.inv^ntj .on .relates to a,sys£eni for using attribute .information to 

enable *a..user to obtain access. to a resource. In, one^em.bodiment,. the .system includes a- client 
associated withra user,, an attribute authority,, and. a r yerifier. capable of verifying .the set of the 
attribute data using the attribute certificate and the verification data. In one embodiment, the 
attribute authority includes an attribute certificate including a digital signature calculated using as 

25 input a root of a hash tree generated based on attribute data for the user, a first set of the attribute 
data, a second set of the attribute data based on the first set of the attribute data^ first verification 
data capable of verifying the first set of the attribute data, and second verification data capable of 
" verifying the second set of the attribute data. The attribute authority transfers the attribute 
certificate, the first set of the attribute data, and the first verification data to the client. The client 

30 then transfers the attribute certificate, the second set of the attribute data, and the second 
' verification data to the verifier, ari'ci the verifier provides the client with" access to a resource 
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based on verification of the second set of the attribute data using the attribute certificate and the 
second verification data. 

In one embodiment, the first set of attribute data and the second set of attribute data are 
the same set. In a further embodiment, the second set of attribute data is a subset of the first set 
5 of attribute data. 

In a further aspect, the invention relates to an attribute certificate, including a root of a , 
hash tree generated from attribute data for a user, and a digital signature calculated using the root 
as input. In one embodiment, the hash tree includes leaves, and the leaves include the attribute 
data. 

10 In another aspect, the invention relates to attribute information for providing a user with 

access to a resource, including an attribute certificate including a digital signature calculated 
using as input the root of a hash tree generated from attribute data for the user and verification 
data capable of verifying a set of the attribute data. In one embodiment, the verification data 
includes authentication path data identifying a path from the root to one or more leaves of the 

1 5 . hash tree. In another embodiment, the verification data includes hash tree node values. 

Brief Descriptions of the Drawings ' - ' 

The invention is pointed out with particularity in the appended claims.' The above and 
further advantages of this invention may be better - understood by referring to the following 
description taken in conjunction with the accompanying drawings, in which: 1 ' * " 1 

20; ; .-" ..-FIG. 1 illustrates a functional block diagram of an attribute certification system according 

* -.to one embodiment .of the invention. . . . — ; dm .; - .. .i?- s :: & 

' . - . : FIG. 2 illustrates a functional block diagram of a verification system for" verifying 
attribute information received from a. user for one embodiment of the invention. 

• • FIG. 3 illustrates a diagrammatic view of a hash tree of attribute information for one 
.25 embodiment of the invention.. _ i: r> :. , - 

. FIG. 4. illustrates. a flow chart of the process of generating an attribute certificate, a set of 
! . attribute .data,. and verification data for one embodimentof the invention.' 
■ ■. : . FIG. 5 illustrates a portion of the hash tree of FIG/ 3, including ; verificatioji data. : * 

Detailed Description of the Invention * : - : ^ i 

30 Figure 1 illustrates an embodiment of ah attribute certification system- 10 that provides- 

attribute information from an attribute authority 12. The attribute information enables -a* client 
system 14 to obtain access to a resource 16. In one embodiment, the attribute information 
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includes an attriBufe certificate 22 ; a set of attribute data 24 used to access one or more resources 
16 ; and verification data 26 used to verify the set of attribute data." 

' " "Typically, a user 15 is associated with the client system 14. In one embodiment, the user 
1 5* is physically located at a client computer system 14 and uses the client 14 to access an 
5 attribute authority server computer 12 and a resource server computer 1 6 over a network. More 
specifically, the client i4, ohbehalf of the user 15-, requests 20 ait authorization credential from 
the attribute authority 12 that can be tised to access the resource 16. The authorization credential 
.* is based on attribute data associated with the user- 15.- In one embodiment, the authorization 
credential is an attribute certificate 22. The resource 16 includes a verifier 1 8 for verifying the 
10 authorization credential provided by. the client 1 4 to the resource 16. 

In one embodiment, the client system 14 may be a personal computer, workstation or 
hardware security device in communication with the attribute authority 12 and the resource 16. 
In one embodiment, the user 15 is using another computer system; such as a remote computer 
system on a network that is in communication with the client 14. In another embodiment, the 
15 client 14 obtains the authorization credential on behalf of the user 15 at a specific time^such'as 
early in the morning before the user 15 arrives at the client 14 to start the working day. The 
client. 14-auth^nticates the user, 15 before. providing the authorization credential to the user 15 or 
. using it-on behalf .of the. user .15., .An. additional benefit is that .the attribute authority -12 can 
preeenerate the authorization credentials in. advance of a request by, the user .15. • „ a - 

*./20 " 'w'^-t'Iii oh*e.'embodimenti;the:user 1'SdsIndt Limited to^a human user communicating with a 
computer system. In this embodiment, the user 15 is.aiV'erftity th&t requests an- authorization 
credential: For exaffipley:i*n'cfne embodiment, theilser'J'&m'ay be- a- software program, collection 
of software programs; soft ware:object; software afgent rUlsIIX daemon, or otHer software* 
construct; executing- on "^the samd or -a' different cdmputer^than- the- client 14. For example, the 

25 user 15 may be a mail daemon that requests authorization to send-electroriic mail -to bne'or more 
- ' recipients"/' In'another embodiment; the user 15 is a hardware electronic^ circuk/ integrated chip, 
ASIC (application specific integrated circuit), or robot,' In a further embodiment,- the user 15 is 
an : :AJ.(aftifi'cially intelligent) entity." In one-embodiment, the user 15 is a digitarcomputer. In 
another embodiment, the user 1 5 is an analog, nanotephnology-based, optical or other type of 

30-.. computer. ; In a- further embodiment the user 15. is. a .software- agent acting on behalf of a human 
;operator ; of a computer to- search, purchase, or perform other functions over a network, such as 
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the Internet. In a further embodiment, the user software 15 is an integrated part of the client 
system 14. 

The attribute .authority 12, the client 14 5 and the resource 16- may be connected in a local 
computer network, direct cable or wire connection, modem connection, global network such as 
5 the Internet, or other connection allowing communication of data among the attribute authority 
12, the client 14, and/or resource 16. -Communications among the attribute authority 12, client 
14, and resource may be based on electrical, microwave, infrared, optical, acoustic, or other 
communication mechanisms. 

In one embodiment, the resource 16 is a computer system, a database, or other resource 
1 0 that the user 1 5 desires to connect to through the client 14. In one embodiment, the resource 1 6 
provides computational resources or data that the user 1 5 needs. In another embodiment, the 
resource 16 is a physical location or entity that the user 1 5 desires to access or use, such as a 
room, a locked automobile, or the locked ignition mechanism for an automobile. 

In another embodiment, the verifier 18 verifies attributes of the user 15. In another 
15 embodiment, the verifier 18- verifies the authorization of the user 15 to take certain actions, such 
as authority to commit a company to engage in transactions by the user 1 5 acting as an agent of 
the company. ■ .*..,.♦■-" 

'In one embodiment,- the verifier 18 is part of the resource 16. -In another embodiment, the 
verifier 1 8 is electronically connected to the resource" -1 6, but is" not part of the resource 1 1 6. In 
20' * one embodiment, the verifier 1 8 is a software- progfanr executing on' an independent computer' 
■ ■ * system- - In another embodiment, the verifier 1 8' is a softwaf e program- executing Gri a ? resource 

- - computer system 1 6. In a further embodiment,' the verifier ! 8 ! fs a hardware integrated circuit or 

. device, such as an ASIC. 

'The attribute authority i 2 stores or has access to- attribute data that is associated with the 
25 user 15. The attribute data includes information that can : be used to access a large number of 

- ■ different resources 16.' For example, a'user 15 could potentially iise the client 14 to atcess 1000 

or more resources 16. The attribute authority 12 would have attribute data associated with each 
resource 16. - - > y. \ ■ : 

In one embodiment of the-ihventioh, the -user 1 5 -uses ; the client 14 to make a request 20 
30 for authorization information, such as attribute information and/or an attribute- certificate, for ' 
access to only one resource 16. In another embodiment, the user 15 may-use the client 14 to 
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request access to two or more resources 1 6. In another embodiment, the client 1 4 makes the 
request 20 without the user 15 making an explicit request. Rather, the client automatically 
requests access based orv another action taken by a user 15, for example, commencement of a 
1 • particular software application.- The attribute authority 12" ; responds to the request 20 and 
5 'provides input 'information-^ the client 14/ including an input attribute certificate 22, an input set 
: of attribute data 24 -that- is used'to* access the resource 1 6v and input verification data 26, which 
can be used to verify the input set of attribute data-24" 

After receiving the input information the client 14 then transfers output information to the 
verifier 1 8 of the resource 16, including an output attribute certificate 2 S fan- output set of 
10. attribute data 30, and output verification data -32. ' In one embodiment; the user 1 5 requests the 
- client 14 to send the output information. In another embodiment, the : client* "14 automatically 
sends the output information upon receiving the input information. In another embodiment, the 
client 14 receives'the input information at one point in time, stores it, and provides the output 
• -information to the verifier *1 8 at another point in time.. After receiving the output information, 
15. the verifier 1 8 verifies the .output set of attribute data 30 using the output attribute certificate 28 
. . and the output verification data 32 provided by the client 14. If the verification is successful, the 
verifier 1 8 then allows the client 14 to access 34 the resource 16. 

•\ , In one embodiment, the : input set of attribute data 24.includes attribute data for one or 

-more resources ,16, up to. the complete set of attribute data that the user 1 5 can possibly, access. 
2Q>-. : That is v if the. user 15*e^ : accesScupto -1000 resources I6j the input -set of a.ttribute : data 24 can; 
- : . -include attribute,-da^ 16. . Intone embodiment, the output set of 

- ; attribute data 30 is the same, set of -attribute, data as thjs input set 24. In another embodiment, the 
output set of attribute data 30 is a subset of the input set of attribute data. 24. 

. / -^ln-anptherjemjjpdimen^ certificate 22 .-includes the input verification 

25 - , data 26 or a portion of : the verification-data 26. In a; further embodiment-the, output; attribute *- 
: certificate 28 includes Jhe .output verification data 32- or a portion of the. outputverifi cation data 

FIG. 2 illustrates a functional block diagram of a verification system for verifying 
; .--attrit^tejnfqm auser^lp^inGluding a; user >1 5, a : resource 16, and a 

30 , - verification system 36 for one embodiment of the.invention.. The verification systpm 36 includes 
.* ; a verifier 1:8 .and, an -input interface34 for receiving the output attribute certificate 28 ? output set 
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of attribute data 30, and output verification data 32 from the user 15. The verifier 1 8 verifies the 
output set of attribute data 30 and allows the user 15 access 34 to the resource 16. 

In one embodiment, the user 1 5 has previously obtained the output information, that is. 
the attribute certificate 28, the attribute data 30, and verification data 32, and then stored the 
5 output information in a storage medium, such as a hard disk, diskette, or CD-ROM or memory 
element, such as ROM or RAM. The user 1 5 then recovers the output information from the 
storage medium and provides it to the input interface 34.- In another embodiment, the user 15 has 
the output information stored on a smart card or other device that can be read by the input 
interface 34. In one embodiment the smart card is a PC card, such as a PCMCIA (Personal 

10 Computer Memory Card International Association) card. 

-In one embodiment, the user 15 is seated at a computer system and uses the computer 
system to transfer the output information to the verification system 36. In one embodiment, the 
user 15 is using a computer or other device, and the user's computer, the resource 16; and the 
verification system 36 are connected electronically, such as in a computer network, by modem, or 

15 other electrical communication. In another embodiment, the computer system used by the user 
15 is a client computer system' 14 used in a manner similar to that shown in FIG. 1 and discussed 
previously. 

In one embodiment, the input interface 34 is a network interface connected through a 
; . . .. network to a computer system or other device operated by the user 15. . In another embodiment 
20 the input interface 34 is any suitable communication interface^ such as ^keyboard, mouse, serial 
■ .- port, modem interface or other interface for commimicating writh computers or other hardware - 
- :* devices. In'a. further embodiment, the input interface 34 is fa security device, capable of reading a 
portable storage medium provided by the user 15, such as a diskette^CD-ROM, smart card, or 
' - : smart token. In another embodiment, the input interface 34 is a device capable; of receiving 
25 optical, video, or other .transmissions. , , : -..^ . * , r 

' '* ' In one embodiment, the input interface 34 and the verifier 18 are part of thie r verification 
system 36. In one example, the verification system 36'is a computer system. In one v 
embodiment, the verification system 3 6 and the resound 1 6 are part of the same system, such as 
one computer system, in another embodiment, the verification system-36 and resource '16 are 
30 separate systems connected by a communications 1 link such as an electronic link*(not shown in 
fig. 2). ■ ■ : - ■ * : • ' ' r ' V V 1 ; 1 * " • ■ " 
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- - - * - r ' ' ' 

FIG. 3 illustrates a diagrammatic view of a hash tree 40 of leaves of attribute data 42 in 

one embodiment of the invention. The hash tree 40 can be constructed by a generally known 

process, such as described in U.S. Patent No. 4309,569 ;: Method of Providing Digital 

Signatures 5 ' to Merkle, which provides a detailed discussion of hash trees. 

5 In FIG. 3, the outermost leaves of the hash tree -40 are represented by leaves Al through 

A8 of attribute data 42a, 42b, 42c, 42d,-42e ; 42f,,42g, 42h (referred to generally as 42). Each 
leaf of attribute data 42 includes a quantity of attribute data 42. Ip one embodiment, each leaf of 
the attribute data 42 is associated with one resource 16 that the user 15 has authorization to 
access, and may include such information related to that resource 16 as a password that provides 

10 access to that resource 16. In another embodiment, each leaf of attribute data 42 is not required 
to be associated with one resource 1 6, but several leaves of attribute data 42 may represent one 
resource 16. In another embodiment, each leaf of attribute data 42 includes attribute data 42 for 
several resources 16. In a further embodiment, the attribute data 42.may include privilege or 
group membership information applicable to multiple resources. The resources recognize that 

15 membership in a certain group carries with it an authorization associated with that group. 

A first level of hash tree nodes 44 is fomied by calculating a one-way "hash" function on 
* - each leafof attribute data*42' to produce-first- level nodes 44 illustrated by 44a through 44h with 
- associated h^h-vallies^HCAa^^thro^gh^HCAg)'^ FIG, 3. Each first level node 444s the' resultant 
: " : ' " -'hashed -value of applying the one- Way T unction'tb 'the attribute 'data. Thus, the value* of node 44a 
20 : '** 7 is%e ft&heH^ one-way function-no the- attribute data in 

* --'leaf 42k. :: The bne-way'has-h function-can be anyone of commonly used- and known -one-way 
"**'■ *■ functions knoWn4n tKe field- of coptograpKy.-ln^additidli to -the function -being*, a -one-way 
- : function/a* collision resistant property -may also b : e desirable. Intone embodiment, the one-way 
function is the SHA (Secure Hash Algorithm) described- in- the SHS^Secure Hash Standard) M 
25 , the NIST (National Institute, of Standards and Teclmology)..NIST.FIPS VJJBA 80-1 , "Secure Hash 
Standard" .U.S. .Department of Commerce, April 17, .1995. Anothej oneway function that may 
be used in another embodiment of the invention is MD5 as described in R.L. .Rivest,. "The MD5 
„ ■Message : pigest;Algorkhm/\ i IE^ Task Force). RPC (Request for 

* .Commented 32 1,-April 1992. An additional one-way hash function that may. be.used in another 
30 embodiment of the invention is RIPEMD-160, as described in H. Dobbertin, A. Bosselaers and 
B. Preneel, "RIPEMD-160: A Strengthened Version of RJPEMD," in D. Gollmann, Editor, Fast 
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Software Encryption, pp.7 1-82, Lecture Notes in Computer Science 1039, Springer- Verlag, 1996 
(or see http://wvvw.esat.kuleuven.ac.be/-bosselae/ripemdl60.html) . 

A second level of hash nodes 46 is formed by calculating the one-way hash function on 
the values of the first level nodes 44. Thus, in FIG. 3, for node 46a, the value H(A1,A2) 
5 represents the hashed value of applying the hash function to the values H(A1 ) and H(A2) in the 
nodes 44a and 44b in the first level of nodes 44. In one embodiment, the values H(A1) and 
H(A2) can be concatenated together and the one-way function then applied to the concatenated 
value. In other embodiments, other methods of hashing may be used to produce a resultant 
hashed value, H(A1,A2), from two input values, such as the hashed values H(A1) and H(A2). In 
1 0 another embodiment, the approach used is the one described in U.S. Patent No. 4,3.09,569 to 
Merkle to produce the hashed value of H(A1,A2) from the values of H(A1) and H(A2). In a 
further embodiment, the resultant hashed value may be based on multiple values, such as 
multiple hashed values or multiple leaves of attribute data 42. 

A third level of hash nodes 48 is formed by calculating the one-way hash function on the 
15 values of the second level nodes 46. In FIG. 3, the notation H(A1,A4) for node 48a is used to 
represent the resultant hash value that results from applying a hash function to the values 
H(A1,A2) and H(A3,A4) in the nodes 46a=and 46b. Thus, H(A1,A4) is a single.hashed value 
that represents the attribute data A 1 through A4 contained in leaves 4'2a. through 42d, 
-„.::_-. ; FIG. 3 shows one example only. The number. of leaves;;nodes,' arid branches shown in 
20 • the- example is illustrative, and is not intended to limit the invention to a. specific implementation. 
; ; . ■ j: .- For example, a hash tree 40;can have more or less than eight.leaves of attribute' data 42*. For a£ 
* * larger hash tree 40, additional levels of hashed node values beyond the levels 44, 46, 48 'shown in 
FIG. 3 can be calculated^ such. as fourth, fifth, and additioriaLleyels; r as required by the size of the 
hash tree 40; In one embodiment, the hash tree is not required to: be balanced, but some branches 
25 - may have more*nodes4han other.branches. The general structure of the tree .is that. of a directed 
' ; graph with a root. . . . . . ' . , . j ..." 

At the base of the hash tree 40, a single hashed .valuers calculated-ta represent all of the 
fc . . leaves of attribute data 42. In FIG..3, this fourth node level, or root, 50 is illustrated. by node 

H(Al,A8),which is calculated from the values. of the third .level nodes 48a and 43b, that is, 
30 H(Al,A4)andH(A5,A8). . . . •;; • . .v." 

Because the hash tree, is: a.set of one-way values,, when the authority- 12 signs the. root 50, 
, it is as if it signed the whole tree. The short t path from any.leaf to the root 50, even if there are 
many leaves of attribute data 42, minimizes the calculations. necessary to verify a:leaf; ; 
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As described above for FIG. 1 3 a user 15 or client 14 receives an attribute certificate 22, 
attribute data 24, and verification data 26 from the attribute authority 12. In one embodiment, 
attribute data 42 are allocated to the leaves of the hash tree 40 as described above for FIG. 3, and 
tfie hash tree 40, including the root 50 ? is calculated from the attribute data 42. The attribute 
certificate 22 includes a digital signature calculated using the root 50 as input. In one 
embodiment, the client 14 receives the selected leaves of the attribute data 42 as the input set of 
attribute data 24. Verification data 28 includes a portion of the hash tree 40 that is sufficient, 
along with the selected leaves of attribute data 42 ; to verify the root 50, as described in more 
detail below. In one embodiment, the client 14 provides output information to the verifier 1 8 
including the output attribute certificate 28, the output set of attribute data 30, and the output 
verification data 32. The verifier 18 uses the attribute certificate 28 and the verification data 32 
to verify the set of attribute data 30 to allow access to a resource 1 6. 

In another embodiment, as shown in FIG. 2, the user .15. receives the selected leaves of the 
attribute data 42 and provides the attribute certificate 28, the set of attribute data 30, and the 
verification data 32. to the verification system 36. . 

• ; FIG. 4 illustrates a flowchart of the process of generating- the- input attribute certificate 22, 
the input set ofattribute data 24, and the input verification data 26. First,* the attribute 'authority 
-^"creates a^asb-tree 40.based :on all-of the attribute. data 42- associated with a user 15. including 
•the calaulation^of-the roat.5.0 of the hash tree 40 (step-il00). In another embodiment}' the hash"- 
"-treMQriS'basedTon a'subsetbf'th'e: attribute; data 42, with* different hash trees 40Tdr each*' subset of 
*the f attribute data-42rL Tiie-attribute authority '12 calculates a digital-signature using the root 50 of 
-the hash tree 4.0:as input-^slep: 1 02) 'possibly as well -as "bthef elements such as the li'se-r's name, 
-the attribute authority^ nam e;,and>a date. In one eimfro.diment/the digit'aUsignature- is calculated 
- using therprivate key of the attribute authority 12 in 'a public/privatevkey. System, In another 
embodiment, the attribute authority 12 uses any other digital signature method that provides for a 
digital signature:calculati on :using the root 50. as input. * In one embodimenVthe -attribute 
.authority 12 uses a digital signature scheme based ori-PSS (probabilistic, signature scheme). In 
'this' approach, a signature As appended" to the d : ata that is signed (the^oot 50"'and possibly other 
elements), and the verification operation is applied to the signature afid the.data'that is signed." In 
•another; embodiment, a PSS.-R''(PSS-recovery)' approach is^used, and some- or all-of the data that 
-assigned (the foot 50 and. possibly other elements) can be^ recovered from the?digital signature. 
The attribute authority <;12'thenxreates*.an attribute; certificate -22 that includes, the digital signature 
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(step 104) and possibly other elements. In one embodiment, the attribute certificate 22 includes 
the digital signature, but does not directly include the root 50, although the root 50 is included 
indirectly because the digital signature is calculated using the root 50. in another embodiment, 
the attribute certificate 22 includes the root 50 directly along with the digital signature. 
5 The attribute authority 12 selects a set of input attribute data 24 based on the user's 1 5 

request for those resources 16 the user 15 wishes to access (step 106). The attribute authority 12 
determines the. verification data that the client 14 can send to the verifier 18 as output verification 
data 32. -The verifier 18 verifies the output set of attribute data 30 using the output attribute 
certificate 28 and output verification data 32 received by the verifier 18 from the client 14 (step 
10 1 08).' In one embodiment, the input attribute certificate 22, the input set of attribute data 24, and 
the input verification data 26 are the same as the output attribute certificate 28, the output set of 
attribute data 30, and the output verification data 32. In another embodiment any or all on the 
input information to the client 22, 24, 26 is derived from or otherwise different from the output 
information 28, 30, 32. 

15 In one embodiment, the attribute authority 12 uses the hash tree 40 to determine the input 

verification data 26. The client 14 must provide sufficient information in the output verification 
data 32 so that the verifier 1 8 can determine a calculated root of the hash tree 40 which is then 
compared to the initial root 50 of the hash tree 40. If the attribute certificate 22 includes the root 
'50 along with the digital signature, or the root 50 can be recovered from the digital signature in 

20 the case of a signature scheme with message recovery, then the verifier 1 8 verifies the digital 
signature on the attribute certificate 22, recovers the root 50 from the digital signature if 
necessary, and compares the calculated root of the hash tree 40 with the initial or recovered root 
50 associated with the attribute certificate 22. If the digital signature is valid and the calculated 
root and the initial or recovered root 50 are substantially similar or equal, then the verifier 1 8 can 

25 authenticate the user 15 and allow for access by the user 15 to the resource 16. In this approach, 
the verifier 18 may verify the digital signature on the attribute certificate 22 separately from 
processing the hash tree 40, which is convenient because it is similar to how attribute certificates 
22 without hash trees 40 are verified in existing systems. 

In another embodiment, if the attribute certificate 22 does not include the root 50 and the 

30 root 50 cannot be recovered from the digital signature, then the verifier 18 verifies the digital 

signature on the attribute certificate 22 with the calculated root as input. If the digital signature is 
valid, then the verifier is assured that the calculated root and the initial root 50 are substantially 
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similar or equal, and the verifier 18 can authenticate the user 15 and perform further processing 
as above. 

The verifier 1 8 may also wish to authenticate the user 15 for any of a variety of 
conventional authentication mechanisms, such as a password provided by a user 1 5, or a 
challenge and response approach. 

For example, referring again to FIG. 3, suppose the user 15 requests, through the client 
14, the attribute data A8 associated with leaf 42h. The verifier 18 receives this data from the 
client 14 as the output set of attribute data 30 (FIG. 1), but the verifier 1 8 can only calculate the 
first level hash node 44h from the data A8 in leaf 42h (see FIG. 3). The output verification data 
32 must include enough information about other nodes in the hash tree 40 to allow the verifier 1 8 
to calculate a calculated root equal to the initial root 50. This is shown in FIG. 5. 

FIG. 5 illustrates a portion of the hash tree 40 of FIG. 3, including the leaves and nodes of 
the hash tree that could be used as verification data 32 for attribute data A8. The verification 
data 32, as shown in FIG. 5, includes the nodes 48a, 46c, and 44g. Using the hashed values from 
nodes 44g and 42h, the verifier 1 8 can calculate the hashed value in node 46d. Using the hashed 
value from node 46c from the verification data 32 and the hashed value from node 46d/the 
verifier 18 can calculate the hashed value for 48b. Using the hashed values from node 48a from 
the verification data 32 and node 48b, the verifier 18 can then determine a calculated root, which 
can be compared to the initial or recovered root 50 of the hash tree 40. 

Node values such as 48a, 46c and 44g are referred to as an authentication path, which is a 
path of nodes in the hash tree 40 for a node of interest (such as 42h) sufficient to verify the 
attribute data in the node (such as attribute data A8 in node 42h) by providing enough nodes in 
the hash tree 40 to produce a calculated root, which can then be compared to the initial or 
recovered root 50. The root 50 is implicit in the construction of the hash tree 40, and the 

....... . , . , •. * ■ * •* < •; - . _ - 

authentication path allows the root 50 to be reconstructed. If the. node of interest (42h) can be 
thought of as a child node, then the authentication path can be thought of as a list of siblings, 
uncles and aunts, great-uncles and great aunts, and cousins such that the common ancestor or 
root 50 in the tree 40 can be identified. 

In another embodiment, the attribute certificate 22 includes a root 50 and a partial 
verification data, such as a partial authentication path. This allows the verifier 1 8 to access the 
partial verification data directly from the attribute certificate 22 and thus simplifies validation of 
a portion of the hash tree 40. In this embodiment, additional verification data may be included in 
the separately transmitted verification data 32. 
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The authentication path can also be thought of as providing sufficient information to 
authenticate a path from the root to the leaf data of interest (such as 42h); that is, the verifier 18 
can determine that 42h is a valid piece of attribute data in the hash tree 40, and therefore there 
must be a valid path from the attribute data 42h to the root 50. 
5 The verification data 32, in the example given for FIG. 5, can. include other nodes, such 

as 46a 5 46b. 46c, and 44g (see FIG. 3), so long as enough nodes are provided to. allow the verifier 
1 8 to determine a calculated root of the hash tree 40 that can be compared to the initial or 
recovered root 50 received in the output attribute certificate 28. In one embodiment, the verifier 
1 8 verifies more than one leaf of the tree 40. This may occur, for example, if several leaves of 
1 0 attribute data 42 are needed to access a resource 16. 

An advantage of the embodiment described here is that the verifier 18 only receives the 
attribute data 42, such as A8, that is needed to access the resource 16. The verifier 18 does not 
receive the other attribute data 42 such as Al through A7, which may be held secret and not 
distributed when not needed. 
15 Also, the input attribute certificate 22 and output attribute certificate 28 are prevented 

from growing to an unmanageable size. For example, the attribute certificate 28 is not required 
to include all of the attribute data 42, but only a digital signature (or, in another embodiment, the 
root 50. and digital signature). The input verification data 26 and output verification data 32 are 
also restricted in size because they only need to include a sufficient number of hash values to 
20 determine a calculated root, and not every hash value or attribute value in the hash tree 40. 

In addition, the hashed values, for the hash tree 40 can be calculated independently of 
when the user 15 requests access 20 to a resource 16. Thus the input attribute certificate 22 can 
be precalculated. For example, when the user .15 requests access 20 to a resource 16 that requires 
attribute data A8, the attribute authority 12. is not required to calculate the associated hash values 
25 in the authentication path for A8. The attribute authority 12 does not have to recalculate a . 

signature on the specified attribute data 42. For example, as shown in FIG. 5, hashed values of 
nodes, such as 48a, 46c, and 44g, can be precalculated, stored, and provided for the input 
verification data 26 for attribute data A8 in node 42h when needed. 

In one embodiment of the invention, the attribute certificate 22 includes the user's public 
t 30 key. In alternate embodiments, the public key may be an attribute of the attribute certificate 22, 
or may be conveyed as a separate part of the attribute certificate 22. The client 14 then 
authenticates the user 1 5 to the verifier. 1 8 by performing a cryptographic operation with the 
user's 15 corresponding private key. according to conventional protocols based on public-key 
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cryptography, 'as is Known in the art. 'Using this approach, the set of verifiers 18 to which the 
client 14 may authenticate the user 15 is unlimited. However, it may be more efficient if the 
authentication is directed to a particular verifier 1 8, as described further. 

In another embodiment, an attribute includes the encryption of a 
symmetric key with the verifier's 1 8 public key or with a key-encryption key 

shared by the attribute authority '12 'and the verifier 18 using encryption techniques well known in 
the art. The attribute authority 12 

provides the symmetric key to* the client 14 in addition to the attribute 
information. The verifier 18'decrypts the attribute with its private key or the 
shared key-encryption key to recover the symmetric key. The client 14 then 
authenticates the user 15 to the verifier 1 8 by providing or by performing 
cryptographic operations with the symmetric key. The symmetric key should be 
changed periodically to prevent replay attacks, for instance each time a new 
attribute certificate 22 is issued. 

In another embodiment of the invention, the system 10 is used with a secure channel, 
such as an SSL channel such as "provided by the KeON system from RSA Security Inc. The 
secure channel provides for the secure transmission of data over the channel between computer 
system's. ' In one embodiment. this may be accomplished by a cryptographic approach. In another 
embodiment/ the' secure channel is a physical connection, such as a cable secured from physical 
tapping* or monitoring of the transmission. The client 14 is connected to the attribute authority 

""1 2 'and "the resource 1*6 by the secure channel f In this embodiment/the set* of attribute data 24, 30 

"bah be'fransmitted without an additional stage of -encryption and any sensitive data, such as 
passwords irfthe set of attribute 'data'24 9 "30 is protected frorn'discovery during transmission by 

^the secure channel. : The verifier 'l 8* that receives the attribute' data 3'0 does not need to engage in 
a separate decryption step to obtain the password, as is the case when individual attributes are 
encrypted separately with the verifier's 18 public key. If the attribute authority 12 provides the 

" sensitive data such as encrypted password to the client 1*4 in addition to the attribute information, 
the client 14 can then authenticate the user 1 5 to the verifier 1 8 by providing or performing 
cryptographic operations with the" sensitive data. However, the sensitive data may also be used 
without the client's 14 participation." For instance, the sensitive data may include a password that 
the verifier! 8 provides to "the resource 1*6.* '* . 

" * ■ ' * Tn another emWdiment/tFie roof 30 or value derived from it "is" provided by the attribute 
'authority 12 to tfteclieht 1 4 through a* secure channel, and*then 1 provided by the client 14 to 
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selected verifiers 1 8 through a secure channel, but is not generally made public. The root 50 or 
value derived from it thus provides a secure way of identifying and authenticating the user 15, 
assuming that the selected verifiers 18 can be trusted not to disclose the value. This approach is 
an improvement over the general approach where the root 50 or value derived from it is made 
5 public or is available to potentially untrusted verifiers 1 8, since in that case the attribute 
certificate 22 only authorizes but does not authenticate the user 15. 

Having described the preferred embodiments of the invention, it will now become 
apparent to one of skill in the art that other embodiments incorporating the concepts may be 
used. It is felt, therefore, that these embodiments should not be limited to disclosed embodiments 
10 but rather should be limited only by the spirit and scope of the following claims. 
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CLAIMS 

What is claimed is: 

1 . A method for providing attribute information to a user, the attribute information providing the 
user with access to a resource, comprising the steps of: 

Generating a hash tree from attribute data associated with a user, the hash tree comprising 

a root; 

selecting a set of the attribute data; 

determining, in response to the generated hash tree and the selected set of the attribute 
data, verification data capable of being used to verify the set of attribute data; 
calculating a digital signature using the root as input: 
generating an attribute certificate comprising the digital signature; and 
providing the attribute certificate, the verification data, and the set of the attribute data to 
the user. 

2. The method of claim 1, wherein the step of generating an attribute certificate comprises 
generating an attribute certificate comprising the root and the digital signature. 

3. The method of claim 1, wherein the step of generating a hash tree comprises allocating the 
attribute data to leaves of the hash tree; and the step of determining the verification data 
comprises determining the verification data for at least one leaf of the hash tree. 

4. The method of claim 3, wherein the step of determining the verification data comprises 
providing authentication path data enabling identification of a path from the root to the at least 
one leaf of the hash tree. 

5. The method of claim 3 wherein the step of determining the verification data comprises 
providing hash tree node values. 

6. The method of claim 3, wherein the step of generating the hash tree comprises generating a 
plurality of hash trees, and the step of generating the attribute certificate comprises generating the 
attribute certificate from at least one root of the plurality of hash trees. 

7. The method of claim 1, wherein the step of generating the attribute certificate comprises 
generating the attribute certificate independently of a request by the user. 

8. The method of claim 1 8 wherein the step of generating the attribute certificate comprises 
generating the attribute certificate comprising the root of the hash tree, the verification data, and 

. the digital signature. 



WO 01/43344 



PCIYUSOO/33606 



-19- 

1 9. The method of claim 1 , further comprising the step of encrypting the set of the attribute data 

2 before the step of transferring the attribute certificate, the verification data, and the set of the 

3 attribute data to the user, wherein the transferring step comprises transferring the encrypted set of 

4 ' the attribute data to the user. 

1 10. An attribute authority for providing attribute information to a user, the attribute information 

2 providing the user with access to a resource, comprising: 

3 attribute data for a user; 

4 a hash tree generated based on the attribute data; 

5 an attribute certificate comprising a digital signature calculated using a root of the hash 

6 tree as input; and 

7 verification data determined in response to the generated hash tree and the attribute data 

8 for the user, the verification data capable of being used to verify a set of 'the attribute data in the 

9 hash tree, 

10 wherein the attribute authority provides the attribute certificate, the verification data, and 

11 the set of the attribute data to the user. 

1 11. The attribute authority of 1 0, wherein the attribute certificate comprises the root and the 

2 digital signature. 

1 12. The attribute authority of claim 1 0 3 wherein the hash tree comprises leaves comprising the 

2 ' attribute data, and the verification data comprises the verification data for at least one leaf of the 

3 hash tree.' 

1 13. The attribute authority of claim r 1 2, wherein the verification data comprises, authentication 

2 path data enabling identification of a path from the root to the at least one leaf of the hash tree. 

1 14. The attribute authority of claim 12, wherein the verification data comprises hash tree node 

2 values. 

. 1 15. The attribute authority of claim 12, wherein the attribute certificate comprises at least one 

2 root of a plurality of hash trees generated based on the attribute data. 

1 16. The attribute authority.of claim 10^ wherein the attribute authority generates the attribute 

2 certiScate independently of a request by the user. M . ( . 

1 17. The attribute authority of claim 10, wherein the attribute certificate comprises .the root of the 

2 hash tree, the verification data, and the digital signature. 
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1 18. The attribute authority of claim 10, "wherein the attribute information comprises the attribute 

2 certificate, the verification data, and an encrypted set of the attribute data. 

1 1 9. A method for verifying attribute information received from a user, comprising the steps of: 

2 receiving an attribute certificate comprising a digital signature calculated using as input 
' 3 an initial root of a hash tree, wherein the hash tree is generated from attribute data associated 

4 with a user; 

5 receiving a set of the attribute data; 

6 receiving verification data associated with the set of the attribute data; verifying the 
' 7 set of the attribute data using the attribute certificate arid the verification data; and 

8 allowing access to a resource in response the step of verifying the set of the attribute data. 

1 20. The method of claim 19, wherein the step of verifying the set of attribute data comprises 

2 determining a calculated root based on the verification data and the set of the attribute data, and 

3 verifying the digital signature using the calculated root as input. 

1 21. The method of claim 19, wherein the step of verifying the set of attribute data comprises 

2 verifying the digital signature, determining the initial root from the attribute certificate, 

3 determining a calculated root based on the verification data and the set of the attribute data, _and 

4 comparing the initial root and the calculated root. 

1 22. The method of claim. 19 5 >yherein the step of verifying the set of attribute data comprises 

2 verifying the digital signature, determining a recovered root from the digital signature, 

3 determining a calculated root based on the verification data and the set of the attribute data, and 

, ' 1 . r * T O r ji" ' r~ T * ' f i ' \ - : * ■ ' % ;*. _ ; ; r "_'"**"■ \ 2 

4 * comparing the recovered root arid the calculated root! 

i *' . j ij t !. O . ^ ' ... i O ".* * ' ' •_""*_ 

1 23. The method of claim 19, wherein the step of receiving the attribute certificate comprises 

2 ' "receiving the initial root and "the digital signature. 

1 24. The method of claim 1 9, wherein the step of allowing access comprises determining a 

2 recovered' root from the digital signature and authorizing access td tlie resource by the' user by 

3 using the recovered root arid the verification data to authenticate" the set of the- attribute data'. 

Y' 25': The method of claim 19, wherein 'the step of allowing access comprises determining a 

2 calculated root based on the verification ^data' and on the set" of the attribute data/ and comparing 

: 3- "the calculated root and "the initial iroot. . ' s * . - *,■...- 
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1 26. The method of claim 19, wherein. the step of allowing access comprises determining 

2 authentication path data from the verification data and determining a direct path from the initial 

3 root to at least one leaf of the hash tree based on the authentication path data. 

1 27. The method of claim 19, wherein the step of allowing access comprises determining hash 

2 tree node values from the verification data. 

1 28. The method of claim 19, wherein.the step. of receiving the attribute certificate comprises 

2 receiving a plurality of initial roots. of a plurality of hash trees and receiving a digital signature 

3 based on the plurality of initial roots. 

1 29. The method of claim 19, wherein the step of receiving the attribute certificate comprises 

2 receiving the attribute certificate comprising the initial root of the hash tree, the digital signature, 

3 and the verification data. 

1 30. The method of claim 19, wherein the step of receiving the set of the attribute data comprises 

2 receiving an encrypted set of the attribute data and decrypting the encrypted set of the attribute 

3 data. 

1 3 1 . A system for verifying attribute information received from a user, comprising: 

2 an input interface for receiving from a user: 

3 an attribute certificate comprising a digital signature calculated using as input an j 
^ 4 - ' initial-root of a hash tree generated based on attribute data; ' " *" " 

5 • ' * a set of the attribute data associated with'thfe user; " ' - 

6 verification data for the set of the attribute data; and 

. 7- . ; . a verifier in electrical communication with the input interface; the, verifier capable of . 

8 verifying the set of the attribute data using, the attribute certificate and the .verification data; 

9 . v wherein the input interface transfers the attribute certificate, the set of the attribute data, 

10 and the verification data .to the .verifier, and the verifier allows access to, ai.reso.urGe;.based on 

1 1 verification of the set of the attribute data using the attribute certificate, and the verification data. 

1 32. The system of claim 31, wherein the verifier determines a calculated root based on the 

2 , verification data and the set of attribute data, and verifies the digital signature using the 

3 calculated root as input. : * ■ . ■ ■ . - . . r: :~ . ' ■ ■ ■.. i ■■ ■• " . > 

1 33. The system of claim 31, wherein the verifier verifies the digital signature, determines the 

2 initial root from the attribute certificate, determines a calculated root based on'the verification 

3 data and the set of the attribute data, and compares the initial roof and the calculated root. 
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1 34. The system- of 'claim 3 1 5 wherein tfie verifier verifies the digital signature, determines a 

2 recovered root from 'the digital signature, determines a calculated root based on the verification 

3 data and the set of the attribute- data, and compares the recovered root and the calculated root. 

1 * 35. - The system of claim 3h wherein the attribute certificate comprises the initial root and the 

2 digital signature. ' ...... 

1 - 36. The system of claim 31, wherein the verifier authorizes access to the resource by the user by 

2 determining a recovered root from the digital signature and by using the verification data and the 

3 recovered root to authenticate the set of the attribute data. 

1 37. The system of claim 31. wherein the verifier determines a calculated root using the 

2 verification data and the set of the attribute data as input, and compares the'calculated root and 

3 the initial root. 

1 38. The system of claim 31, wherein the verifier determines authentication path data from the 

2 verification data and determines a direct path from the initial root to at least one leaf of the hash 

3 tree using the authentication path data. 

1 39. The system of claim 31, wherein the verifier determines hash tree node values from the 

2 verification data. 

1 40. The system of claim 31, wherein the initial root is a plurality of initial roots of a plurality of 

2 hash trees and the verifier calculates the. digital signature using the. plurality of initial roots as • 

3 in P ut :iv: : . . ' • J. * ..^ ' 

1 * 41 .* The system of claim. 31i/.wherein the' attribute certificate 6'omprises the initial root of the hash 

2 .tree, the* digital signature, and. the -verification data based on the set of the attribute* data. - 
.1 42. ^The, system of claim 3 1 V wherein the- set of the attribute data is an- encrypted' set of the 

2 , attribute data -and^the verifier decrypts -the enciypted'set of the attribute data.- 

1 43. A'methocI tor using attribute infofrriation'to obtain access to a resource/ comprising'the steps 

2 Of. ' • - : :! • C . ^ ' ' ' * ^ - ' ' " * i . * . . . 

3 - ■/ ^receiving an attribute certificate' comprising a digital signature calculated using* asinput a 

4 root of a hash tree, the hash tree generated based on attribute data for a user; L 

5 . . . ... _ receiving the ^attribute data;.. , . !r . - . . ^ - 

6 , receiving verification data capable of verifying the attribute dat£; 

7 _ < transferring tQ a resource,the ^attribute certificate, the attribute data, and the. verification 
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8 data; 

9 verifying the attribute data using the attribute certificate and the verification data; and 
10 obtaining access to the resource in response to the step of verifying the attribute data. 

1 44. The method of claim 43, wherein the step of receiving the attribute data comprises receiving 

2 a set of the attribute data;. the step of receiving the verification data comprises receiving 

3 verification data capable of verifying the set of the attribute data; the step of transferring to the 

4 resource the attribute certificate, the attribute data, and the verification data comprises 

5 transferring to the resource the set of the attribute data; and the step of verifying the attribute data 

6 comprises verifying the set of the attribute data. 

1 45. The method of claim 43, wherein the step of receiving the attribute data comprises receiving 

2 a set of the attribute data; the step of receiving the verification data comprises receiving set 

3 verification data capable of verifying the set of the attribute data; the step of transferring to the 

4 resource the attribute certificate, the attribute data, and the verification data comprises 

5 transferring to the resource a subset of the attribute data and subset verification data capable of 

6 verifying the subset of the attribute data ; and the step of verifying the attribute data comprises 

7 verifying the subset of the attribute data using the attribute certificate and the subset verification 

8 . data. ■ ■ ■ • ■ . ... .. 7 : .. ■. ;.• 

1 46. The method of claim 43, wherein the step of receiving the attribute' certificate comprises 

■■■ ^ 2 : _. receiving the attribute certificate comprising the roatand the digital signature, t , • ; 

1 47. A system for using attribute information to enable a user to obtain access : ta k 7 resdurce 3 

' : '2 * comprising: ; *■■"""*■ ' -i - ; * r v : -* v \ ' vv,:j-- : - r .. .. 

3 a client associated with a user; ; ' - - *- ' " * : r - . - • 

4 an attribute authority comprising: ■ : 1 

5 - an attribute certificate f comprising a digital signature, calculated using as input a 
6.-. root of a hash tree generated based t on attribute data for the user; ; ■ 1 

7 t . a first set of the attribute data; 

8 a second set of the attribute data based on the first set of the attribute data; 

9 first verification data capable of verifying the first set of the attribute data, 

10 wherein the attribute authority transfers the attribute certificate, the first set of the attribute data, 

1 1 and the first verification data to the client; and 

12 second verification data capable of verifying the second set of the attribute data, 
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13 a verifier capable of verifying the second set of the attribute data using the attribute 

14 certificate and the second verification data, 

1 5 wherein the client transfers the attribute certificate, the second set of the attribute data, 

1 6 and the second verification data to the verifier, and the verifier provides the client with access to 

17 a resource based on verification of the second set of the attribute data'using the attribute 

18 certificate and the second verificariorr data. 

1 48. Asystem as in claim 47 5 "wherein the first set of "the "attribute'data arid the second set of the 

2 attribute data are the same set. 

1 49. A system as in claim 47, wherein the second set of attribute data is a subset of the first set of 

2 attribute data. 

1 50. A system as in claim 47, wherein the attribute certificate comprises the root and the digital 

2 signature. 

1 51. An attribute certificate, comprising: . - 

2 a root of a hash tree generated from attribute data for a user; and 

3 . a digital signature calculated. using. the root as input. 

1 52. The attribute certificate of claim 51, wherein the hash tree comprises leaves and the leaves 

2- . comprise^the attribute, data: , ... : - - - : 

1 53. Attribute -information for providing a' user with access to a resource, the attribute information 

2 v..v?POTsing:. ... -; ijt>: , ; f -. J; , . . , : . . :. ■ • . . . : _ ? - \ r - 

3 an attribute certificate comprising a digital signature calculated using as -input the root of 

4 a hash tree generated from attribute data for the user;, and* V// t - 

5 verification data capable of verifying a set. of .the attribute data. 

.-].- ~'54\ vphe attribute information - of claim 53, wherein the verification data comprises 

2 authentication path data-'ide'ntifying a path from the root- to at- least one -leaf of the hash "tree. 

1 55. The attribute information of claim 53, wherein the verification data comprises hash tree 

2 node values. 
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